This weakness occurs when a cryptographic key is embedded directly in source code, configuration files, or compiled binaries instead of being generated, stored…
This weakness occurs when a cryptographic key is embedded directly in source code, configuration files, or compiled binaries instead of being generated, stored securely, or retrieved from a protected key management system. Because the same key is used across all deployments and can be extracted through code review, decompilation, or memory inspection, encryption becomes ineffective — an attacker who obtains the code gains access to the key and can decrypt all protected data.
Developers hard-code keys for convenience during development or testing, then forget to replace them with a secure key management approach before deployment. Hard-coded keys appear in source repositories, compiled artifacts, container images, and configuration files that are often less protected than runtime secrets. Even if the key is obscured or encoded (Base64, hex), it remains discoverable through static analysis. Once extracted, the key works identically across every instance of the application, meaning a single compromised key exposes all encrypted data everywhere the software runs.
An attacker who gains read access to source code, a compiled binary, or a deployed configuration file can extract the hard-coded key and decrypt all data encrypted with it — including stored passwords, API tokens, personal information, and session data. This transforms encryption from a security control into a false sense of protection. In regulated environments (healthcare, finance, payment processing), reliance on hard-coded keys can result in compliance violations and breach notification obligations.
import os
from cryptography.fernet import Fernet
# Hard-coded key embedded in source
SECRET_KEY = "gAAAAABmK3x5vL9pQ2r8sT1uV4wX5yZ6aB7cD8eF9gH0iJ1kL2mN3oP4qR5sT6u"
def encrypt_user_data(user_id, sensitive_data):
cipher = Fernet(SECRET_KEY)
encrypted = cipher.encrypt(sensitive_data.encode())
return encrypted
def decrypt_user_data(encrypted_data):
cipher = Fernet(SECRET_KEY)
return cipher.decrypt(encrypted_data).decode()Why it's vulnerable:
The encryption key is visible in the source code and will be identical across all deployments. Anyone with access to the code repository or compiled application can extract it and decrypt all protected data.
import os
from cryptography.fernet import Fernet
def get_cipher():
# Retrieve key from environment variable or secure key management service
key = os.environ.get("ENCRYPTION_KEY")
if not key:
raise ValueError("ENCRYPTION_KEY environment variable not set")
return Fernet(key)
def encrypt_user_data(user_id, sensitive_data):
cipher = get_cipher()
encrypted = cipher.encrypt(sensitive_data.encode())
return encrypted
def decrypt_user_data(encrypted_data):
cipher = get_cipher()
return cipher.decrypt(encrypted_data).decode()<?php
// Hard-coded key in source file
define('ENCRYPTION_KEY', 'base64:gAAAAABmK3x5vL9pQ2r8sT1uV4wX5yZ6aB7cD8eF9gH0iJ1kL2mN3oP4qR5sT6u');
function encrypt_user_data($user_id, $sensitive_data) {
$key = base64_decode(str_replace('base64:', '', ENCRYPTION_KEY));
$iv = openssl_random_pseudo_bytes(16);
$encrypted = openssl_encrypt($sensitive_data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
return base64_encode($iv . $encrypted);
}
function decrypt_user_data($encrypted_data) {
$key = base64_decode(str_replace('base64:', '', ENCRYPTION_KEY));
$data = base64_decode($encrypted_data);
$iv = substr($data, 0, 16);
$encrypted = substr($data, 16);
return openssl_decrypt($encrypted, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
}
?>Why it's vulnerable:
The encryption key is hard-coded in the PHP file and will be committed to version control and deployed to all servers. Static analysis tools and code review will expose it immediately.
<?php
function get_encryption_key() {
// Retrieve key from environment variable or secure key management service
$key = getenv('ENCRYPTION_KEY');
if (!$key) {
throw new Exception('ENCRYPTION_KEY environment variable not set');
}
return base64_decode($key);
}
function encrypt_user_data($user_id, $sensitive_data) {
$key = get_encryption_key();
$iv = openssl_random_pseudo_bytes(16);
$encrypted = openssl_encrypt($sensitive_data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
return base64_encode($iv . $encrypted);
}
function decrypt_user_data($encrypted_data) {
$key = get_encryption_key();
$data = base64_decode($encrypted_data);
$iv = substr($data, 0, 16);
$encrypted = substr($data, 16);
return openssl_decrypt($encrypted, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);
}
?>Search your source code repositories and configuration files for patterns like KEY=, SECRET=, PASSWORD=, or base64-encoded strings that appear to be cryptographic material. Check git history for commits that added or modified encryption keys. Review access logs for your key management system to identify unauthorized retrieval attempts or unusual access patterns.
